Network UPS Tools upsmon: server-supplied UPS alarm text is executed as a shell command, often as root

Impact

upsmon pastes the ups.alarm string it receives from upsd straight into the shell commands run by notify(), async_notify() and wall(). On any node where an operator has set NOTIFYCMD and put EXEC in NOTIFYFLAG ALARM, shell metacharacters in that alarm text run as the upsmon account, which in most packaged installs is root. UPS and PDU monitoring normally runs on the facility management network across many nodes at once, so one malicious or compromised upsd - or a man-in-the-middle on a plaintext upsd-to-upsmon link - gives the same command execution on every machine monitoring it. TLS between upsd and upsmon does not close the compromised-device path, because a hostile UPS can feed the alarm string in through its driver upstream of upsd.

Who can reach it

No authentication to upsmon itself is needed. The attacker must control an upsd that a node monitors, sit on the plaintext upsd-to-upsmon connection, or control the UPS/PDU hardware whose driver supplies the alarm. Exploitation also requires the operator to have configured NOTIFYCMD with EXEC on NOTIFYFLAG ALARM.

What to do

Upgrade NUT to 2.8.6 and restart upsmon on every monitoring host; 2.8.3 through 2.8.5 are affected. If an upgrade cannot be scheduled, remove EXEC from NOTIFYFLAG ALARM or stop passing alarm text to a NOTIFYCMD, which removes the exploit path without a package change. This is a userspace daemon restart - no node drain or reboot is implied.

References

Related entries

• Linux kernel FC transport: malformed FPIN ELS frame hangs the kernel via a u8 pname walker counterCVE-2026-63889 · Linux kernel scsi_transport_fc (FPIN pname_count walker, lpfc/qla2xxx initiators)High
• Dell OpenManage Enterprise: low-privileged remote user can inject SQL into the management consoleCVE-2026-70422 · Dell OpenManage Enterprise (management console, SQL injection)High
• Dell OMSA: improper privilege management lets a low-privileged remote user tamper with the nodeCVE-2026-81442 · Dell OpenManage Server Administrator (privilege management)High
• Dell OMSA: missing authentication on a critical function lets an unauthenticated attacker execute codeCVE-2026-81475 · Dell OpenManage Server Administrator (managed node web/agent service)High
• Dell OMSA: unauthenticated OS command injection gives remote execution on the managed nodeCVE-2026-81476 · Dell OpenManage Server Administrator (managed node service, OS command handling)High
• Dell OMSA: hard-coded cryptographic key allows unauthenticated access to the management agentCVE-2026-81478 · Dell OpenManage Server Administrator (hard-coded cryptographic key)High